summaryrefslogtreecommitdiff
path: root/nginx/nginx.conf
AgeCommit message (Collapse)Author
2022-05-03enable thread pool AIO supportDaniel Micay
2022-05-03drop configuration for clearing legacy push cookieDaniel Micay
2022-05-02add resolver setup to baseline configurationDaniel Micay
2022-04-30disable traditional stateful TLS session cacheDaniel Micay
This is useless for TLSv1.3 since there's no longer any distinction in the protocol based on whether the server is using stateless or stateful session resumption. OpenSSL has a non-standard anti-replay mechanism for 0-RTT based on stateful session resumption but 0-RTT still ends up being a downgrade for the TLS security properties. nginx disables that feature since otherwise 0-RTT wouldn't work with the default stateless approach. Since this cache is only used for TLSv1.2 when stateless resumption isn't disabled and nearly all TLSv1.2 clients support tickets, it isn't getting any significant use. It provides worse forward secrecy than tickets because we implement ticket key rotation based on the expiry time and sessions aren't actively purged from the stateful cache when they expire. Cached session state varies in size and nginx ends up writing errors to the log when clearing out a session fails to make room for a new one due to it being larger. It's best to finally get rid of this flawed approach to session resumption. TLSv1.3 provides the option of forward secrecy for resumed sessions and it's the only approach that's normally enabled so we don't need to worry about this anymore once TLSv1.2 is disabled as long as we never enable 0-RTT which weakens forward secrecy and other security properties.
2022-04-17use IPv6 only for internal nginx status serviceDaniel Micay
2022-03-06add transparent Zcash donation addressDaniel Micay
2022-02-19extend redirect.js preload / push to /install/Daniel Micay
2022-02-19set up preload and push for redirect.jsDaniel Micay
2022-02-19simplify configurationDaniel Micay
2022-02-01avoid redirect for double slash in parametersDaniel Micay
2022-01-27add grapheneos.dev domainDaniel Micay
2022-01-13workaround for odd CSP semantics in Chromium 97Daniel Micay
2022-01-03improve approach to redundant slash redirectionDaniel Micay
Since merge_slashes gets rid of the redundant slashes, a no-op rewrite will get rid of all of them at once instead of requiring one redirect to get rid of each redundant slash.
2021-12-11rename push cookie for clarityDaniel Micay
2021-12-11add preload/push for main page phone imageDaniel Micay
2021-12-10set charset in Content-Type header for CSS tooDaniel Micay
2021-12-05use http2_push instead of http2_push_preloadDaniel Micay
This avoids needing to conditionally add nopush to each preloaded resource in the Link header. There's also no support for pushing JavaScript modules via http2_push_preload since nginx doesn't have support for rel=modulepreload.
2021-12-04no need for case insensitive match for cookie nameDaniel Micay
2021-12-04avoid sending unnecessary push cookieDaniel Micay
2021-11-27simplify /mask-icon.svg redirectDaniel Micay
This no longer needs to use a regular expression as a workaround now that file path replacement uses template syntax.
2021-11-26use preload header with nopush for repeat visitorsDaniel Micay
2021-11-26add integrity metadata to preload headerDaniel Micay
2021-11-24disable idle-detection in Permissions-PolicyDaniel Micay
2021-11-23update font version for preload/pushDaniel Micay
2021-11-18set up SRI for future use by CSP v3Daniel Micay
2021-11-11Nginx regex: don't capture groups unnecessarilyRohan Kumar
Good regex form: use "?:" to specify non-capturing groups when sections don't actually reference matched groups. There's no use saving a capture in these situations.
2021-09-07nginx: use syslog for error_logDaniel Micay
2021-08-30add another FAQ redirectDaniel Micay
2021-08-22add redirect for broken backlinks with commaDaniel Micay
2021-08-10add SVG Tiny Portable/Secure icon for BIMIDaniel Micay
https://bimigroup.org/ https://datatracker.ietf.org/doc/html/draft-svg-tiny-ps-abrotman-00
2021-07-30rename primary to 0 and replica1 to 1Daniel Micay
2021-07-30add support for ACME with replicasDaniel Micay
2021-06-26nginx: use build defaults for user/pid settingsDaniel Micay
This varies based on the OS and packaging. It's best to make the assumption that it's a reasonable nginx package rather than reducing portability.
2021-06-22cleaner nginx status monitoring configurationDaniel Micay
2021-06-21add back legacy redirectDaniel Micay
2021-06-21set security headers for Matrix client metadataDaniel Micay
2021-06-13fix redirects for broken twipu linksDaniel Micay
2021-06-11fix object replacement character redirectDaniel Micay
2021-06-07convert if back into location blockDaniel Micay
2021-06-04remove legacy underscore redirects (unused)Daniel Micay
2021-06-03add redirect away from old SVG faviconDaniel Micay
2021-06-02reorder nginx location blocksDaniel Micay
2021-06-02make index files into an implementation detailDaniel Micay
2021-06-02treat html extension as an implementation detailDaniel Micay
These redirects aren't being used for any of the actual pages based on the access logs.
2021-05-31add grapheneos.ca domainDaniel Micay
2021-05-28add grapheneos.net domainDaniel Micay
2021-05-24add Matrix client homeserver delegationDaniel Micay
2021-05-24add Matrix homeserver delegationDaniel Micay
2021-05-23drop types_hash_max_size configurationDaniel Micay
2021-05-19simplify favicon.svg rewriteDaniel Micay
generated by cgit v1.3.1 (git 2.54.0) at 2026-09-03 19:56:06 +0000